Avatar billede breon Nybegynder
28. december 2006 - 12:30 Der er 9 kommentarer og
1 løsning

Omdirigering af søgeresultater (hijackthis + fixwareout log)

Når jeg søger på Google bliver søgeresultaterne omdirigeret til en anden side, som fx Wordsea.com eller Sestat.com.

Jeg fandt denne artikel (http://www.eksperten.dk/artikler/999?Esession=193) der måske kan være løsningen, så nu poster jeg en hijackthis + fixwareout log.

jeg har også kørt scanninger med AdAware og SpyBot, men ingen af de to kan gennemføre scanningerne. De går begge død undervejs.

Hijackthis log
---------------------------------------
Logfile of HijackThis v1.99.0
Scan saved at 12:22:28, on 28-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Norman\npm\bin\nvoy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Norman\npf\bin\npfsvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Norman\npm\Bin\Zanda.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Programmer\Norman\npc\bin\npcsvc32.exe
C:\Programmer\Norman\npm\bin\NJEEVES.EXE
C:\Programmer\Norman\Nvc\bin\nvcoas.exe
C:\Programmer\Norman\npc\bin\nuaa.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Norman\npf\bin\npfuser.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Norman\npm\bin\ZLH.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Norman\nvc\BIN\NIP.EXE
C:\Programmer\Picasa2\PicasaMediaDetector.exe
C:\Programmer\Norman\nvc\bin\cclaw.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\- Utilities -\IE Privacy Keeper\IEPrivacyKeeper.exe
C:\Programmer\Skype\Phone2\Skype.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programmer\Samurize\Client.exe
C:\Programmer\- Utilities -\SpywareGuard\sgmain.exe
C:\Programmer\- Utilities -\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\Programmer\Skype2\Plugin Manager\SkypePM.exe
C:\Programmer\- Utilities -\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tv2.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {00A24B03-DD53-09FF-B089-5061C12D30FD} - C:\WINDOWS\system32\atliy.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\- Utilities -\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Programmer\Norman\npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programmer\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NPCTray] C:\Programmer\Norman\npc\bin\npc_tray.exe /LOAD
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [IE Privacy Keeper] "C:\Programmer\- Utilities -\IE Privacy Keeper\IEPrivacyKeeper.exe" -stcleanup
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone2\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Startup: Client Default.lnk = C:\Programmer\Samurize\Client.exe
O4 - Startup: Samurize.lnk = C:\Programmer\Samurize\Client.exe
O4 - Startup: SpywareGuard.lnk = C:\Programmer\- Utilities -\SpywareGuard\sgmain.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O15 - Trusted Zone: *.bgbank.dk
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - http://netbank.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://80.164.11.164/v2/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{8742F14A-6661-4AC6-A9D0-80BCE70F9FA5}: NameServer = 85.255.114.23,85.255.112.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6B769CF-66E7-469B-95FA-C5A88C625A86}: NameServer = 85.255.114.23,85.255.112.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA484355-6AAD-48F4-90D0-A47643531C97}: NameServer = 85.255.114.23,85.255.112.220
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O18 - Protocol: bw+0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll (file missing)
O23 - Service: Google Updater Service - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper - AHEAD Software - C:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: License Management Service ESD - element5 - C:\Programmer\Fælles filer\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norman NJeeves - Unknown - C:\Programmer\Norman\npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown - C:\Programmer\Norman\npm\Bin\Zanda.exe
O23 - Service: Norman Parental Control - Norman ASA - C:\Programmer\Norman\npc\bin\npcsvc32.exe
O23 - Service: Norman Personal Firewall Service - Norman ASA - C:\Programmer\Norman\npf\bin\npfsvc32.exe
O23 - Service: Norman User Activity Agent - Norman ASA - C:\Programmer\Norman\npc\bin\nuaa.exe
O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\Programmer\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Unknown - C:\Programmer\Norman\Nvc\BIN\NVCSCHED.EXE (file missing)
O23 - Service: Norman V.O.Y. - Norman ASA - C:\Programmer\Norman\npm\bin\nvoy.exe



Fixwareout log
---------------------------------------

Fixwareout
Last edited 12/06/2006
Post this report in the forums please
...
Prerun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"="csvyf.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dmnfe.exe"="C:\\WINDOWS\\system32\\dmnfe.exe"

...
...
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1D345D113779-1888-4CB4-F805-9766F874{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\efnmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\0mdm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1mdm
...

Random Runs removed from HKLM
"dmnfe.exe"=-
...
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»
Search five digit cs, dm kd and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSVYF.EXE      51.746 2006-09-28   
C:\WINDOWS\SYSTEM32\DMNFE.EXE      60.989 2004-08-27

Other suspects.

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.
...
Postrun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""

...
Avatar billede tafkab Nybegynder
28. december 2006 - 12:33 #1
Fix lige disse med hijackthis

O2 - BHO: Class - {00A24B03-DD53-09FF-B089-5061C12D30FD} - C:\WINDOWS\system32\atliy.dll (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{8742F14A-6661-4AC6-A9D0-80BCE70F9FA5}: NameServer = 85.255.114.23,85.255.112.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6B769CF-66E7-469B-95FA-C5A88C625A86}: NameServer = 85.255.114.23,85.255.112.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA484355-6AAD-48F4-90D0-A47643531C97}: NameServer = 85.255.114.23,85.255.112.220
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.23 85.255.112.220
Avatar billede breon Nybegynder
28. december 2006 - 12:35 #2
Efter at have kørt Fixwareout, bliver mine søgeresultater vist ikke kapret længere, men jeg synes stadig jeg kan se noget skidt i hijackthis loggen.
Avatar billede breon Nybegynder
28. december 2006 - 12:38 #3
ny hijackthis log



Logfile of HijackThis v1.99.0
Scan saved at 12:37:39, on 28-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Norman\npm\bin\nvoy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Norman\npf\bin\npfsvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Norman\npm\Bin\Zanda.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Programmer\Norman\npc\bin\npcsvc32.exe
C:\Programmer\Norman\npm\bin\NJEEVES.EXE
C:\Programmer\Norman\Nvc\bin\nvcoas.exe
C:\Programmer\Norman\npc\bin\nuaa.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Norman\npf\bin\npfuser.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Norman\npm\bin\ZLH.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Norman\nvc\BIN\NIP.EXE
C:\Programmer\Picasa2\PicasaMediaDetector.exe
C:\Programmer\Norman\nvc\bin\cclaw.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\- Utilities -\IE Privacy Keeper\IEPrivacyKeeper.exe
C:\Programmer\Skype\Phone2\Skype.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programmer\Samurize\Client.exe
C:\Programmer\- Utilities -\SpywareGuard\sgmain.exe
C:\Programmer\- Utilities -\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\Programmer\Skype2\Plugin Manager\SkypePM.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmer\- Utilities -\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tv2.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\- Utilities -\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Programmer\Norman\npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programmer\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NPCTray] C:\Programmer\Norman\npc\bin\npc_tray.exe /LOAD
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [IE Privacy Keeper] "C:\Programmer\- Utilities -\IE Privacy Keeper\IEPrivacyKeeper.exe" -stcleanup
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone2\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Startup: Client Default.lnk = C:\Programmer\Samurize\Client.exe
O4 - Startup: Samurize.lnk = C:\Programmer\Samurize\Client.exe
O4 - Startup: SpywareGuard.lnk = C:\Programmer\- Utilities -\SpywareGuard\sgmain.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O15 - Trusted Zone: *.bgbank.dk
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - http://netbank.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://80.164.11.164/v2/XUpload.ocx
O18 - Protocol: bw+0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {E6114BDD-B387-4D12-8575-EB4AD34AD325} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll (file missing)
O23 - Service: Google Updater Service - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper - AHEAD Software - C:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: License Management Service ESD - element5 - C:\Programmer\Fælles filer\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norman NJeeves - Unknown - C:\Programmer\Norman\npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown - C:\Programmer\Norman\npm\Bin\Zanda.exe
O23 - Service: Norman Parental Control - Norman ASA - C:\Programmer\Norman\npc\bin\npcsvc32.exe
O23 - Service: Norman Personal Firewall Service - Norman ASA - C:\Programmer\Norman\npf\bin\npfsvc32.exe
O23 - Service: Norman User Activity Agent - Norman ASA - C:\Programmer\Norman\npc\bin\nuaa.exe
O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\Programmer\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Unknown - C:\Programmer\Norman\Nvc\BIN\NVCSCHED.EXE (file missing)
O23 - Service: Norman V.O.Y. - Norman ASA - C:\Programmer\Norman\npm\bin\nvoy.exe
Avatar billede tafkab Nybegynder
28. december 2006 - 12:39 #4
Fjern de linier jeg lige lagde, afinstaller Logitech Desktop Messenger (du har stadig dine drivere ) og kom med en ny log.
Avatar billede tafkab Nybegynder
28. december 2006 - 12:42 #5
Du kan fjerne disse, men det er ikke snavs det hele :-)

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll (file missing)
Avatar billede breon Nybegynder
28. december 2006 - 12:50 #6
Ny log, der er blevet betydelig mindre efter jeg afinstallerede Logitech Desktop Messenger :-)



Logfile of HijackThis v1.99.0
Scan saved at 12:49:07, on 28-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Norman\npm\bin\nvoy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Norman\npf\bin\npfsvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Norman\npm\Bin\Zanda.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Programmer\Norman\npc\bin\npcsvc32.exe
C:\Programmer\Norman\npm\bin\NJEEVES.EXE
C:\Programmer\Norman\Nvc\bin\nvcoas.exe
C:\Programmer\Norman\npc\bin\nuaa.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Norman\npf\bin\npfuser.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Norman\npm\bin\ZLH.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Norman\nvc\BIN\NIP.EXE
C:\Programmer\Picasa2\PicasaMediaDetector.exe
C:\Programmer\Norman\nvc\bin\cclaw.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\- Utilities -\IE Privacy Keeper\IEPrivacyKeeper.exe
C:\Programmer\Skype\Phone2\Skype.exe
C:\Programmer\Samurize\Client.exe
C:\Programmer\- Utilities -\SpywareGuard\sgmain.exe
C:\Programmer\- Utilities -\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\Programmer\Skype2\Plugin Manager\SkypePM.exe
C:\Programmer\- Utilities -\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tv2.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\- Utilities -\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Programmer\Norman\npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programmer\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NPCTray] C:\Programmer\Norman\npc\bin\npc_tray.exe /LOAD
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [IE Privacy Keeper] "C:\Programmer\- Utilities -\IE Privacy Keeper\IEPrivacyKeeper.exe" -stcleanup
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone2\Skype.exe" /nosplash /minimized
O4 - Startup: Client Default.lnk = C:\Programmer\Samurize\Client.exe
O4 - Startup: Samurize.lnk = C:\Programmer\Samurize\Client.exe
O4 - Startup: SpywareGuard.lnk = C:\Programmer\- Utilities -\SpywareGuard\sgmain.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\programmer\norman\npc\bin\nlf.dll
O15 - Trusted Zone: *.bgbank.dk
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - http://netbank.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://80.164.11.164/v2/XUpload.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O23 - Service: Google Updater Service - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper - AHEAD Software - C:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: License Management Service ESD - element5 - C:\Programmer\Fælles filer\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norman NJeeves - Unknown - C:\Programmer\Norman\npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown - C:\Programmer\Norman\npm\Bin\Zanda.exe
O23 - Service: Norman Parental Control - Norman ASA - C:\Programmer\Norman\npc\bin\npcsvc32.exe
O23 - Service: Norman Personal Firewall Service - Norman ASA - C:\Programmer\Norman\npf\bin\npfsvc32.exe
O23 - Service: Norman User Activity Agent - Norman ASA - C:\Programmer\Norman\npc\bin\nuaa.exe
O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\Programmer\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Unknown - C:\Programmer\Norman\Nvc\BIN\NVCSCHED.EXE (file missing)
O23 - Service: Norman V.O.Y. - Norman ASA - C:\Programmer\Norman\npm\bin\nvoy.exe
Avatar billede tafkab Nybegynder
28. december 2006 - 12:54 #7
Hvordan kører den så nu?
Avatar billede breon Nybegynder
28. december 2006 - 13:03 #8
Den ser ud til at køre fint nu. Søgesiderne bliver i hvert fald ikke længere omdirigeret, og hijackthis loggen ser stadig fin ud efter genstart.

Så lav et svar, så du kan få dine velfortjente point :-D

Tak for hjælpen.
Avatar billede tafkab Nybegynder
28. december 2006 - 13:05 #9
Det var godt :-)
28. december 2006 - 14:33 #10
Bare en afslutningsdetalje ->

Du bør rense temp med denne fil, det tager kun få sek.
http://www.spywareinfo.dk/download/cleantempxp2k.bat

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelsesfilerne.
Deaktiver systemgendannelse -> http://www.spywareinfo.dk/#/tip-og-tricks/deaktiver_systemgendannelse.htm
Genstart din computer - aktiver systemgendannelse. Dette gøres samme sted, hvor du deaktiverede, denne gang skal du blot aktivere.
Det vil også være en god idé manuelt at oprette et nyt punkt, som du kan navngive, og vende tilbage til, hvis du skulle få problemer af nogen art.
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester